@mgsoftwarebv/mg-dashboard-mcp 7.4.0 → 7.4.2

package/dist/index.js

@@ -674,26 +674,47 @@ var TRIGGER_TOOLS = [
       },
       required: ["action", "project"]
     }
+  },
+  {
+    name: "trigger-env",
+    description: 'Manage a Trigger.dev project\'s environment variables via the official Management API (the webapp encrypts/decrypts \u2014 no direct SecretStore/DB writes, upgrade-safe). SUPERADMIN ONLY: this reads and writes production secrets across every project. Pick the operation with `action`:\n- "list": all variable names + a secret flag for the env (values are NOT returned \u2014 use "get").\n- "get": one variable. Secret values are masked unless includeSecret=true. Required: key.\n- "set": create or update a variable (upsert) + read-back verify. Required: key, value. Optional: isSecret (only sent when provided, so existing vars keep their flag).\n- "delete": remove a variable. Required: key.\nOn the self-hosted instance only the "prod" environment exists (env defaults to "prod").',
+    inputSchema: {
+      type: "object",
+      properties: {
+        action: { type: "string", enum: ["list", "get", "set", "delete"], description: "Which env-var operation to perform." },
+        project: { type: "string", description: 'Project slug from trigger-list (e.g. "domeinflits-vsJ2")' },
+        key: { type: "string", description: "Environment variable name. Required for get/set/delete." },
+        value: { type: "string", description: 'Value to store. Required for action="set".' },
+        env: { type: "string", description: 'Environment slug. Default "prod" (only prod exists on self-hosted).' },
+        isSecret: { type: "boolean", description: `action="set" only: mark the variable as secret. Omit to leave an existing var's flag unchanged.` },
+        includeSecret: { type: "boolean", description: 'action="get" only: reveal a secret value instead of masking it (default false).' }
+      },
+      required: ["action", "project"]
+    }
   }
 ];
 var TRIGGER_TOOL_NAMES = new Set(TRIGGER_TOOLS.map((t) => t.name));
 var TRIGGER_TOOL_MODULE_MAP = {
   "trigger-list": "ci_cd",
   "trigger-runs": "ci_cd",
-  "trigger-run": "ci_cd"
+  "trigger-run": "ci_cd",
+  // trigger-env manages production secrets → gated behind the admin `settings`
+  // module AND an extra superadmin-only check in index.ts (defense in depth).
+  "trigger-env": "settings"
 };
 async function discoverInstance(projectSlug, conn, proxy, sshExec2) {
-  const sql26 = `SELECT re.\\"apiKey\\" FROM \\"RuntimeEnvironment\\" re JOIN \\"Project\\" p ON re.\\"projectId\\" = p.id WHERE p.slug='${projectSlug}' AND re.slug='prod' LIMIT 1`;
+  const sql26 = `SELECT re.\\"apiKey\\" || '~~' || p.\\"externalRef\\" FROM \\"RuntimeEnvironment\\" re JOIN \\"Project\\" p ON re.\\"projectId\\" = p.id WHERE p.slug='${projectSlug}' AND re.slug='prod' LIMIT 1`;
   const cmd = [
     `PORT=$(docker port "${WA_CONTAINER}" 3000/tcp 2>/dev/null | head -1 | sed 's/.*://')`,
-    `KEY=$(docker exec "${PG_CONTAINER}" psql -U postgres -d main -t -A -c "${sql26}" 2>/dev/null | tr -d '[:space:]')`,
-    'echo "$PORT|$KEY"'
+    `ROW=$(docker exec "${PG_CONTAINER}" psql -U postgres -d main -t -A -c "${sql26}" 2>/dev/null | tr -d '[:space:]')`,
+    'echo "$PORT|$ROW"'
   ].join(" && ");
   const result = await sshExec2(conn, cmd, proxy);
   const output = result.stdout.trim();
   const sepIdx = output.indexOf("|");
   const port = sepIdx > 0 ? output.substring(0, sepIdx) : "";
-  const apiKey2 = sepIdx > 0 ? output.substring(sepIdx + 1) : "";
+  const combined = sepIdx > 0 ? output.substring(sepIdx + 1) : "";
+  const [apiKey2, projectRef] = combined.split("~~");
   if (!port) {
     throw new Error(
       `Could not find webapp port for ${WA_CONTAINER}. Is the container running?`
@@ -704,7 +725,7 @@ async function discoverInstance(projectSlug, conn, proxy, sshExec2) {
       `Could not get API key for project "${projectSlug}". Check if the project slug is correct (use trigger-list).`
     );
   }
-  return { port, apiKey: apiKey2 };
+  return { port, apiKey: apiKey2, projectRef: projectRef || "" };
 }
 async function fetchRunLogs(runId, conn, proxy, sshExec2) {
   const sql26 = `SELECT level, message, \\"isError\\", \\"createdAt\\" FROM \\"TaskEvent\\" WHERE \\"runId\\" = '${runId}' AND level IN ('INFO','WARN','ERROR','DEBUG','LOG','TRACE') ORDER BY \\"startTime\\" ASC LIMIT 200`;
@@ -940,6 +961,108 @@ ${rawJson.substring(0, 500)}` }] };
       return await waitForCompletion(conn, proxy, sshExec2, instance, result.id, waitSeconds);
     }
     // -----------------------------------------------------------------
+    case "trigger-env": {
+      const action = String(args2.action);
+      if (!["list", "get", "set", "delete"].includes(action)) {
+        return { content: [{ type: "text", text: "Error: action must be one of: list, get, set, delete" }] };
+      }
+      const project = String(args2.project);
+      const env = String(args2.env || "prod");
+      const instance = await discoverInstance(project, conn, proxy, sshExec2);
+      if (!instance.projectRef) {
+        return { content: [{ type: "text", text: `Error: could not resolve project ref for "${project}" (use trigger-list).` }] };
+      }
+      const apiBase = `/api/v1/projects/${instance.projectRef}/envvars/${encodeURIComponent(env)}`;
+      if (action === "list") {
+        const raw2 = await triggerApi(conn, proxy, sshExec2, instance, "GET", apiBase);
+        let vars;
+        try {
+          vars = JSON.parse(raw2);
+        } catch {
+          return { content: [{ type: "text", text: `Invalid API response:
+${raw2.substring(0, 500)}` }] };
+        }
+        if (!Array.isArray(vars)) {
+          return { content: [{ type: "text", text: `Unexpected API response:
+${raw2.substring(0, 500)}` }] };
+        }
+        if (vars.length === 0) {
+          return { content: [{ type: "text", text: `No environment variables for ${project}/${env}.` }] };
+        }
+        const lines = vars.map((v) => `${v.isSecret ? "[secret]" : "        "}  ${v.name}`).sort();
+        const text9 = `Env vars for ${project}/${env} (${vars.length}) \u2014 values hidden, use action="get" with a key:
+` + "-".repeat(50) + "\n" + lines.join("\n");
+        return { content: [{ type: "text", text: text9 }] };
+      }
+      if (action === "get") {
+        const key2 = String(args2.key ?? "");
+        if (!key2) return { content: [{ type: "text", text: 'Error: action="get" requires key' }] };
+        const raw2 = await triggerApi(conn, proxy, sshExec2, instance, "GET", `${apiBase}/${encodeURIComponent(key2)}`);
+        let v;
+        try {
+          v = JSON.parse(raw2);
+        } catch {
+          return { content: [{ type: "text", text: `Invalid API response:
+${raw2.substring(0, 500)}` }] };
+        }
+        if (v.error) return { content: [{ type: "text", text: `Error: ${v.error}` }] };
+        const includeSecret = args2.includeSecret === true;
+        const shown = v.isSecret && !includeSecret ? "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022  (secret \u2014 pass includeSecret:true to reveal)" : v.value ?? "";
+        const label = v.isSecret ? " [secret]" : "";
+        return { content: [{ type: "text", text: `${project}/${env}  ${key2}${label}
+${shown}` }] };
+      }
+      if (action === "set") {
+        const key2 = String(args2.key ?? "");
+        if (!key2) return { content: [{ type: "text", text: 'Error: action="set" requires key' }] };
+        if (args2.value === void 0) return { content: [{ type: "text", text: 'Error: action="set" requires value' }] };
+        const value = String(args2.value);
+        const bodyObj = { name: key2, value };
+        if (typeof args2.isSecret === "boolean") bodyObj.isSecret = args2.isSecret;
+        const raw2 = await triggerApi(conn, proxy, sshExec2, instance, "POST", apiBase, JSON.stringify(bodyObj));
+        let resp2;
+        try {
+          resp2 = JSON.parse(raw2);
+        } catch {
+          return { content: [{ type: "text", text: `Unexpected API response:
+${raw2.substring(0, 500)}` }] };
+        }
+        if (!resp2.success) {
+          return { content: [{ type: "text", text: `Error: ${resp2.error || raw2.substring(0, 500)}` }] };
+        }
+        const verifyRaw = await triggerApi(conn, proxy, sshExec2, instance, "GET", `${apiBase}/${encodeURIComponent(key2)}`);
+        let vv;
+        try {
+          vv = JSON.parse(verifyRaw);
+        } catch {
+          vv = {};
+        }
+        const verified = vv.value === value;
+        const flag = typeof args2.isSecret === "boolean" ? ` isSecret=${args2.isSecret}` : "";
+        return {
+          content: [{
+            type: "text",
+            text: `Set ${project}/${env}  ${key2}${flag}
+Verify read-back: ${verified ? "OK" : "MISMATCH \u2014 value did not persist as expected"}`
+          }]
+        };
+      }
+      const key = String(args2.key ?? "");
+      if (!key) return { content: [{ type: "text", text: 'Error: action="delete" requires key' }] };
+      const raw = await triggerApi(conn, proxy, sshExec2, instance, "DELETE", `${apiBase}/${encodeURIComponent(key)}`);
+      let resp;
+      try {
+        resp = JSON.parse(raw);
+      } catch {
+        return { content: [{ type: "text", text: `Unexpected API response:
+${raw.substring(0, 500)}` }] };
+      }
+      if (!resp.success) {
+        return { content: [{ type: "text", text: `Error: ${resp.error || raw.substring(0, 500)}` }] };
+      }
+      return { content: [{ type: "text", text: `Deleted ${project}/${env}  ${key}` }] };
+    }
+    // -----------------------------------------------------------------
     default:
       return { content: [{ type: "text", text: `Unknown trigger tool: ${name}` }] };
   }
@@ -6970,6 +7093,75 @@ var TOOL_MODULE_MAP = {
   "cursor-remote-run": "cursor_remote",
   ...TRIGGER_TOOL_MODULE_MAP
 };
+var SUPERADMIN_ONLY_TOOLS = /* @__PURE__ */ new Set(["trigger-env"]);
+function resolveContentDispatch(tool, a) {
+  const action = typeof a.action === "string" ? a.action : "";
+  const { action: _drop, ...params } = a;
+  const registry = (backendAction) => ({
+    route: "content-registry",
+    body: { action: backendAction, params }
+  });
+  const managed = (backendAction) => ({
+    route: "managed-site",
+    body: { action: backendAction, params }
+  });
+  switch (tool) {
+    // Singletons keep their original names (no `action` discriminator).
+    case "save_content_quality_run":
+      return registry("save_content_quality_run");
+    case "link_content_pack_to_ticket":
+      return registry("link_content_pack_to_ticket");
+    case "content-source":
+      if (action === "save") return registry("save_content_source");
+      if (action === "search") return registry("search_content_sources");
+      if (action === "get") {
+        if (typeof a.id === "string" && a.id) return registry("get_content_source_by_id");
+        if (typeof a.url === "string" && a.url) return registry("get_content_source_by_url");
+        return { error: "content-source action=get needs `id` or `url`" };
+      }
+      return { error: "content-source: action must be save | get | search" };
+    case "research":
+      if (action === "topic")
+        return {
+          route: "research-topic",
+          body: {
+            topic: typeof a.topic === "string" ? a.topic : void 0,
+            urls: Array.isArray(a.urls) ? a.urls : void 0,
+            discover: a.discover && typeof a.discover === "object" ? a.discover : void 0,
+            includeRawText: typeof a.includeRawText === "boolean" ? a.includeRawText : void 0,
+            maxRawTextChars: typeof a.maxRawTextChars === "number" ? a.maxRawTextChars : void 0
+          }
+        };
+      if (action === "save") return registry("save_research_pack");
+      if (action === "get") return registry("get_research_pack");
+      return { error: "research: action must be topic | save | get" };
+    case "content-corpus":
+      if (action === "save") return registry("save_content_corpus_item");
+      if (action === "list") return registry("list_project_content_corpus");
+      if (action === "context") return registry("get_content_context_for_project");
+      return { error: "content-corpus: action must be save | list | context" };
+    case "content-snapshot":
+      if (action === "list") return registry("list_content_snapshots");
+      if (action === "prune") return registry("prune_content_snapshots");
+      return { error: "content-snapshot: action must be list | prune" };
+    case "site-candidate":
+      if (action === "add") return registry("add_site_candidates");
+      if (action === "list") return registry("list_site_candidates");
+      if (action === "set-status") return registry("set_candidate_status");
+      return { error: "site-candidate: action must be add | list | set-status" };
+    case "managed-site":
+      if (action === "register") return managed("register_managed_site");
+      if (action === "update") return managed("update_managed_site");
+      if (action === "list") return managed("list_managed_sites");
+      return { error: "managed-site: action must be register | update | list" };
+    case "content-sync":
+      if (action === "trigger") return managed("trigger_content_sync");
+      if (action === "status") return managed("get_content_sync_status");
+      return { error: "content-sync: action must be trigger | status" };
+    default:
+      return { error: `unknown content tool ${tool}` };
+  }
+}
 function normalizeAllowedTools(value) {
   if (!Array.isArray(value)) return null;
   const tools = value.filter((t) => typeof t === "string").map((t) => t.trim()).filter(Boolean);
@@ -8596,30 +8788,19 @@ var NO_FOOTER_TOOLS = /* @__PURE__ */ new Set();
 var RAW_JSON_TOOLS = /* @__PURE__ */ new Set([
   "get_mg_dashboard_commits",
   "extract_article",
-  "research_topic",
-  // Content registry / corpus (2026-DASMG-041) — compact JSON consumed verbatim.
-  "save_content_source",
-  "get_content_source_by_url",
-  "get_content_source_by_id",
-  "search_content_sources",
-  "save_research_pack",
-  "get_research_pack",
-  "save_content_corpus_item",
-  "list_project_content_corpus",
-  "get_content_context_for_project",
+  // Content family (2026-DASMG-040/041/042) — compact JSON consumed verbatim.
+  // Consolidated action-based tools (the Cursor surface); each proxies to the
+  // backend content-registry / managed-site / research-topic dispatchers, which
+  // still speak the original fine-grained action names.
+  "research",
+  "content-source",
+  "content-corpus",
+  "content-snapshot",
+  "site-candidate",
   "save_content_quality_run",
-  "list_content_snapshots",
   "link_content_pack_to_ticket",
-  "prune_content_snapshots",
-  "add_site_candidates",
-  "list_site_candidates",
-  "set_candidate_status",
-  // Managed site content sync (2026-DASMG-042) — compact JSON consumed verbatim.
-  "register_managed_site",
-  "update_managed_site",
-  "list_managed_sites",
-  "trigger_content_sync",
-  "get_content_sync_status"
+  "managed-site",
+  "content-sync"
 ]);
 var TOOL_CACHE_TTL_MS = {
   "list-servers": 6e4,
@@ -10770,7 +10951,7 @@ var TOOLS = [
   },
   {
     name: "extract_article",
-    description: "Extract readable article/content data from ONE PUBLIC URL, with a browser-render fallback for pages that block a normal fetch (403) or only render with JavaScript (ticket 2026-DASMG-039). Returns title, author, publishedAt, source, summary, facts[], optional rawText (capped), canonicalUrl, the `extractionMethod` used (http | browser | jsonld | rss | amp | metadata_only) and an explicit `limitations` array (e.g. blocked_without_browser, paywall_detected, partial_content, rawtext_truncated). PUBLIC URLs only \u2014 SSRF-guarded (private/loopback/metadata addresses rejected), no paywall bypass, no credentials; the source/canonical URL is always preserved. Use it to turn a news/article link into safe factual source material for agents; it never auto-publishes or rewrites. For several sources + cross-checking, use research_topic.",
+    description: "Extract readable article/content data from ONE PUBLIC URL, with a browser-render fallback for pages that block a normal fetch (403) or only render with JavaScript (ticket 2026-DASMG-039). Returns title, author, publishedAt, source, summary, facts[], optional rawText (capped), canonicalUrl, the `extractionMethod` used (http | browser | jsonld | rss | amp | metadata_only) and an explicit `limitations` array (e.g. blocked_without_browser, paywall_detected, partial_content, rawtext_truncated). PUBLIC URLs only \u2014 SSRF-guarded (private/loopback/metadata addresses rejected), no paywall bypass, no credentials; the source/canonical URL is always preserved. Use it to turn a news/article link into safe factual source material for agents; it never auto-publishes or rewrites. For several sources + cross-checking, use `research` with action=topic.",
     inputSchema: {
       type: "object",
       properties: {
@@ -10790,53 +10971,69 @@ var TOOLS = [
       required: ["url"]
     }
   },
+  // ----- Research + evidence packs (2026-DASMG-040/041), consolidated -----
   {
-    name: "research_topic",
-    description: "Turn SEVERAL public sources on one topic into a single cross-checked, sourced 'evidence pack' (ticket 2026-DASMG-040). Composes extract_article per URL and aggregates: collect, extract, cross-check, then hand a downstream agent a safe base to write ORIGINAL content from. Modes: curated (`urls` + optional `topic`), discovery (`topic` + `discover.enabled` \u2014 finds source URLs for you), hybrid (`urls` + `discover` \u2014 curated seeds topped up by discovery). Discovery uses an env-gated web-search backend (open-web) plus a keyless sitemap crawl over `discover.allowDomains`; with no backend it degrades to a `discovery_unavailable` limitation and curated `urls` still work. The method used is reported as `discovery_method:...`. Returns `sources` (id,url,canonicalUrl,source,title,publishedAt,authorityTier,extractionMethod,limitations), `verifiedFacts` (claim + corroboratedBy + confidence + authorityTier + asOf), `conflicts` (variants + suggestedResolution), `uniqueClaims` (single-source), `openQuestions`, `verbatimWarnings`, and pack-level `limitations`. Structured EVIDENCE ONLY \u2014 never ready-to-publish prose or brand voice; every claim traces back to a source id. PUBLIC URLs only (inherits the SSRF guard). Persist + reuse with save_research_pack / get_research_pack (2026-DASMG-041).",
+    name: "research",
+    description: 'Research + evidence-pack toolkit (2026-DASMG-040/041). Pick the operation with `action`:\n- "topic": turn SEVERAL public sources on one topic into a single cross-checked, sourced \'evidence pack\'. Composes extract_article per URL: collect, extract, cross-check, then hand a downstream agent a safe base to write ORIGINAL content from. Modes: curated (`urls` + optional `topic`), discovery (`topic` + `discover.enabled` \u2014 finds source URLs for you), hybrid (`urls` + `discover`). Returns `sources`, `discovery` report, `verifiedFacts`, `conflicts`, `uniqueClaims`, `openQuestions`, `verbatimWarnings`, `limitations`. Structured EVIDENCE ONLY \u2014 never ready-to-publish prose; every claim traces to a source id. PUBLIC URLs only (SSRF-guarded).\n- "save": persist an evidence pack. Pass an already-built `pack`, or `urls`/`topic` (+ optional `discover`) to research then save. Each source is deduped into content_sources and linked so packs are reusable without re-crawling. Returns pack id + compact counts + linked source ids.\n- "get": fetch a stored pack by `id`. Compact by default; set `includeSources` / `includeClaims` for the full arrays.',
     inputSchema: {
       type: "object",
       properties: {
+        action: {
+          type: "string",
+          enum: ["topic", "save", "get"],
+          description: "topic = build a pack; save = persist a pack; get = fetch a stored pack."
+        },
+        id: {
+          type: "string",
+          description: "action=get: content_evidence_packs.id (uuid)."
+        },
         topic: {
           type: "string",
-          description: "The topic the evidence pack is about (used for labelling, and as the search query in discovery mode)."
+          description: "action=topic/save: the topic the pack is about (also the search query in discovery mode)."
         },
         urls: {
           type: "array",
           items: { type: "string" },
-          description: "Curated list of public http(s) URLs to extract and cross-check (max 20)."
+          description: "action=topic/save: curated public http(s) URLs to extract and cross-check (max 20)."
+        },
+        pack: {
+          type: "object",
+          description: "action=save: an already-built pack payload (skips re-researching)."
         },
         discover: {
           type: "object",
-          description: "Discovery options. enabled=true auto-finds source URLs for `topic` via an env-gated web-search backend plus a keyless sitemap crawl over allowDomains. Curated `urls` are kept and topped up to maxSources; degrades gracefully (discovery_unavailable) when no backend is configured.",
+          description: "action=topic/save: discovery options. enabled=true auto-finds source URLs for `topic` via an env-gated web-search backend + keyless sitemap crawl over allowDomains. Curated `urls` are kept and topped up to maxSources; degrades gracefully when no backend is configured.",
           properties: {
             enabled: { type: "boolean", description: "Turn discovery on (default off)." },
             maxSources: { type: "number", description: "Cap on total sources, curated + discovered (1-12, default 8)." },
-            recencyDays: { type: "number", description: "Prefer/keep sources no older than this (applied to sitemap lastmod)." },
+            recencyDays: { type: "number", description: "Prefer/keep sources no older than this (sitemap lastmod)." },
             locale: { type: "string", description: "Locale hint, e.g. nl-NL." },
-            allowDomains: { type: "array", items: { type: "string" }, description: "Whitelist domains; also the targets for the keyless sitemap crawl." },
-            blockDomains: { type: "array", items: { type: "string" }, description: "Domains to exclude from discovery." }
+            allowDomains: { type: "array", items: { type: "string" }, description: "Prefer/guarantee domains; targets for sitemap top-up." },
+            blockDomains: { type: "array", items: { type: "string" }, description: "Domains to exclude from discovery." },
+            sourcePolicy: {
+              type: "string",
+              enum: ["official_only"],
+              description: "Restrict discovered sources to official whitelist (grid operators, ACM, government)."
+            }
           }
         },
         includeRawText: {
           type: "boolean",
-          description: "Reserved for compatibility; claim mining always reads body text up to maxRawTextChars."
+          description: "action=topic: reserved; claim mining always reads body text up to maxRawTextChars."
         },
         maxRawTextChars: {
           type: "number",
-          description: "Per-source body cap used for claim mining (default 4000, max 20000)."
-        }
-      }
-    }
-  },
-  // ----- Content registry / corpus persistence (2026-DASMG-041) -----
-  {
-    name: "save_content_source",
-    description: "Persist (dedupe + upsert) ONE fetched source \u2014 the durable companion to extract_article (2026-DASMG-041). Pass a `url` (re-extracts internally) and/or already-extracted fields (title/summary/facts/fullText). Dedupes on canonical URL then text hash, and snapshots the previous version into content_snapshots when the text changed. External sources keep their `source_type` so they stay labelled as evidence, never own content. Returns the stored id + a compact summary + whether it was created/updated/snapshotted.",
-    inputSchema: {
-      type: "object",
-      properties: {
-        url: { type: "string", description: "Source URL (required)." },
-        canonicalUrl: { type: "string", description: "Canonical URL used for dedupe." },
+          description: "action=topic: per-source body cap for claim mining (default 4000, max 20000)."
+        },
+        includeSources: { type: "boolean", description: "action=get: return the source list." },
+        includeClaims: {
+          type: "boolean",
+          description: "action=get: return verified facts / conflicts / unique claims."
+        },
+        locale: { type: "string", description: "action=save: locale of the pack." },
+        projectKey: { type: "string", description: "action=save: project identifier." },
+        siteKey: { type: "string", description: "action=save: site identifier." },
+        ticketNumber: { type: "string", description: "action=save: related ticket number." },
         sourceType: {
           type: "string",
           enum: [
@@ -10849,112 +11046,31 @@ var TOOLS = [
             "supplier",
             "unknown"
           ],
-          description: "Provenance label. own_site/client_site = managed content; the rest are evidence only."
+          description: "action=save: provenance label for linked sources."
         },
-        title: { type: "string", description: "Title." },
-        author: { type: "string", description: "Author." },
-        publishedAt: { type: "string", description: "Publish date (any parseable format)." },
-        summary: { type: "string", description: "Short factual summary." },
-        facts: { type: "array", items: { type: "string" }, description: "Key facts." },
-        limitations: { type: "array", items: { type: "string" } },
-        fullText: { type: "string", description: "Extracted body text." },
-        language: { type: "string", description: "Language code." },
-        projectKey: { type: "string", description: "Project/site identifier." },
-        siteKey: { type: "string", description: "Site identifier." },
-        ticketNumber: { type: "string", description: "Related ticket number." },
-        metadata: { type: "object" },
-        reExtract: {
-          type: "boolean",
-          description: "Force a re-fetch even when fields are supplied."
-        }
-      },
-      required: ["url"]
-    }
-  },
-  {
-    name: "get_content_source_by_url",
-    description: "Look up a stored source by URL or canonical URL (2026-DASMG-041). Compact by default (id + summary + counts); set `includeFullText` for the body. Use to answer 'was this link already scanned?' before re-extracting.",
-    inputSchema: {
-      type: "object",
-      properties: {
-        url: { type: "string", description: "URL or canonical URL." },
-        includeFullText: { type: "boolean", description: "Return full_text." }
-      },
-      required: ["url"]
-    }
-  },
-  {
-    name: "get_content_source_by_id",
-    description: "Fetch a stored source by id (2026-DASMG-041). Compact by default; set `includeFullText` for the body.",
-    inputSchema: {
-      type: "object",
-      properties: {
-        id: { type: "string", description: "content_sources.id (uuid)." },
-        includeFullText: { type: "boolean", description: "Return full_text." }
+        metadata: { type: "object", description: "action=save: arbitrary metadata." }
       },
-      required: ["id"]
+      required: ["action"]
     }
   },
+  // ----- Content sources registry (2026-DASMG-041), consolidated -----
   {
-    name: "search_content_sources",
-    description: "Full-text + filter search over stored sources (2026-DASMG-041): query (title/summary/body), domain, sourceType, projectKey, ticketNumber, dateFrom/dateTo. Compact, paginated results. Use to reuse evidence already in the registry.",
+    name: "content-source",
+    description: 'Stored external/evidence sources registry (2026-DASMG-041). Pick the operation with `action`:\n- "save": persist (dedupe + upsert) ONE fetched source \u2014 the durable companion to extract_article. Pass a `url` (re-extracts internally) and/or already-extracted fields (title/summary/facts/fullText). Dedupes on canonical URL then text hash, snapshots the previous version when text changed. Returns the stored id + compact summary + created/updated/snapshotted. Required: url.\n- "get": look up ONE stored source by `id` OR by `url`/canonical url (\'was this link already scanned?\'). Compact by default; set `includeFullText` for the body. Required: id or url.\n- "search": full-text + filter search over stored sources (query, domain, sourceType, projectKey, ticketNumber, dateFrom/dateTo). Compact, paginated. Use to reuse evidence already in the registry.',
     inputSchema: {
       type: "object",
       properties: {
-        query: { type: "string", description: "Free-text search (title/summary/body)." },
-        domain: { type: "string", description: "Exact domain filter." },
-        sourceType: {
+        action: {
           type: "string",
-          enum: [
-            "own_site",
-            "client_site",
-            "external_source",
-            "competitor",
-            "news",
-            "government",
-            "supplier",
-            "unknown"
-          ]
+          enum: ["save", "get", "search"],
+          description: "save = upsert one source; get = fetch by id/url; search = filtered search."
         },
-        projectKey: { type: "string", description: "Project filter." },
-        ticketNumber: { type: "string", description: "Ticket filter." },
-        dateFrom: { type: "string", description: "Last-seen lower bound (ISO/date)." },
-        dateTo: { type: "string", description: "Last-seen upper bound (ISO/date)." },
-        limit: { type: "integer", description: "Max rows (default 20, max 100)." },
-        offset: { type: "integer", description: "Pagination offset." },
-        includeFullText: { type: "boolean", description: "Return full_text per row." }
-      }
-    }
-  },
-  {
-    name: "save_research_pack",
-    description: "Persist a research_topic evidence pack (2026-DASMG-041): cross-checked verified facts, conflicts, unique claims, open questions. Pass an already-built `pack`, or `urls`/`topic` to research then save. Add `discover` (with a topic) to auto-find sources before saving \u2014 the same discovery research_topic does (2026-DASMG-040). Each source is deduped into content_sources and linked via the join table, so packs can be reused without re-crawling. Returns the pack id + compact counts + linked source ids.",
-    inputSchema: {
-      type: "object",
-      properties: {
-        pack: { type: "object", description: "A research_topic result payload." },
-        urls: {
-          type: "array",
-          items: { type: "string" },
-          description: "URLs to research if no pack is given."
-        },
-        topic: { type: "string", description: "Topic to research if no pack is given." },
-        discover: {
-          type: "object",
-          description: "Discovery options (same shape as research_topic). With a topic, enabled=true auto-finds source URLs before saving. Ignored when `pack` is supplied.",
-          properties: {
-            enabled: { type: "boolean" },
-            maxSources: { type: "number" },
-            recencyDays: { type: "number" },
-            locale: { type: "string" },
-            allowDomains: { type: "array", items: { type: "string" } },
-            blockDomains: { type: "array", items: { type: "string" } }
-          }
+        id: { type: "string", description: "action=get: content_sources.id (uuid)." },
+        url: {
+          type: "string",
+          description: "action=save (required) / action=get: source URL or canonical URL."
         },
-        locale: { type: "string", description: "Locale of the pack." },
-        projectKey: { type: "string", description: "Project identifier." },
-        siteKey: { type: "string", description: "Site identifier." },
-        ticketNumber: { type: "string", description: "Related ticket number." },
+        canonicalUrl: { type: "string", description: "action=save: canonical URL used for dedupe." },
         sourceType: {
           type: "string",
           enum: [
@@ -10966,38 +11082,55 @@ var TOOLS = [
             "government",
             "supplier",
             "unknown"
-          ]
+          ],
+          description: "Provenance label. own_site/client_site = managed content; the rest are evidence only. (save/search filter)"
         },
-        metadata: { type: "object" }
-      }
-    }
-  },
-  {
-    name: "get_research_pack",
-    description: "Fetch a stored evidence pack by id (2026-DASMG-041). Compact by default (counts + provenance); set `includeSources` / `includeClaims` for the full arrays.",
-    inputSchema: {
-      type: "object",
-      properties: {
-        id: { type: "string", description: "content_evidence_packs.id (uuid)." },
-        includeSources: { type: "boolean", description: "Return the source list." },
-        includeClaims: {
+        title: { type: "string", description: "action=save: title." },
+        author: { type: "string", description: "action=save: author." },
+        publishedAt: { type: "string", description: "action=save: publish date (any parseable format)." },
+        summary: { type: "string", description: "action=save: short factual summary." },
+        facts: { type: "array", items: { type: "string" }, description: "action=save: key facts." },
+        limitations: { type: "array", items: { type: "string" } },
+        fullText: { type: "string", description: "action=save: extracted body text." },
+        language: { type: "string", description: "action=save: language code." },
+        projectKey: { type: "string", description: "Project/site identifier (save/search)." },
+        siteKey: { type: "string", description: "action=save: site identifier." },
+        ticketNumber: { type: "string", description: "Related ticket number (save/search filter)." },
+        metadata: { type: "object" },
+        reExtract: {
+          type: "boolean",
+          description: "action=save: force a re-fetch even when fields are supplied."
+        },
+        query: { type: "string", description: "action=search: free-text search (title/summary/body)." },
+        domain: { type: "string", description: "action=search: exact domain filter." },
+        dateFrom: { type: "string", description: "action=search: last-seen lower bound (ISO/date)." },
+        dateTo: { type: "string", description: "action=search: last-seen upper bound (ISO/date)." },
+        limit: { type: "integer", description: "action=search: max rows (default 20, max 100)." },
+        offset: { type: "integer", description: "action=search: pagination offset." },
+        includeFullText: {
           type: "boolean",
-          description: "Return verified facts / conflicts / unique claims."
+          description: "action=get/search: return full_text (per row for search)."
         }
       },
-      required: ["id"]
+      required: ["action"]
     }
   },
+  // ----- Own/managed content corpus (2026-DASMG-041), consolidated -----
   {
-    name: "save_content_corpus_item",
-    description: "Upsert ONE own/managed page into the corpus (2026-DASMG-041), keyed by (projectKey, canonical url) \u2014 the current state of content you own. Pass a `url` (re-extracts) and/or title/h1/headings/fullText/internalLinks. Snapshots the previous version when the text changed. Use this for your/your client's pages, not external evidence.",
+    name: "content-corpus",
+    description: 'Your/your client\'s OWN managed pages (the corpus), 2026-DASMG-041. Pick the operation with `action`:\n- "save": upsert ONE own/managed page keyed by (projectKey, canonical url) \u2014 the current state of content you own. Pass a `url` (re-extracts) and/or title/h1/headings/fullText/internalLinks. Snapshots the previous version when text changed. For your pages, not external evidence. Required: projectKey, url.\n- "list": list corpus items for a project, filter by domain/sourceType/query. Compact, paginated. Required: projectKey.\n- "context": aggregate brief for a content agent \u2014 recent corpus items, recent evidence packs and related sources for a project (optionally focused by topic/url), plus totals. One call to brief an agent on what already exists. Required: projectKey.',
     inputSchema: {
       type: "object",
       properties: {
-        projectKey: { type: "string", description: "Project identifier (required)." },
-        url: { type: "string", description: "Page URL (required)." },
-        siteKey: { type: "string", description: "Site identifier." },
-        canonicalUrl: { type: "string", description: "Canonical URL." },
+        action: {
+          type: "string",
+          enum: ["save", "list", "context"],
+          description: "save = upsert one own page; list = list corpus items; context = aggregate agent brief."
+        },
+        projectKey: { type: "string", description: "Project identifier (required for all actions)." },
+        url: { type: "string", description: "action=save (required) / action=context: page URL focus." },
+        siteKey: { type: "string", description: "action=save: site identifier." },
+        canonicalUrl: { type: "string", description: "action=save: canonical URL." },
         sourceType: {
           type: "string",
           enum: [
@@ -11010,76 +11143,42 @@ var TOOLS = [
             "supplier",
             "unknown"
           ],
-          description: "Defaults to own_site."
+          description: "action=save: defaults to own_site. action=list: filter."
         },
-        pagePath: { type: "string", description: "Path within the site." },
-        title: { type: "string", description: "Title." },
-        h1: { type: "string", description: "Main heading." },
+        pagePath: { type: "string", description: "action=save: path within the site." },
+        title: { type: "string", description: "action=save: title." },
+        h1: { type: "string", description: "action=save: main heading." },
         headings: {
           type: "array",
           items: { type: "object" },
-          description: "Headings ({level,text})."
+          description: "action=save: headings ({level,text})."
         },
-        wordCount: { type: "integer", description: "Word count." },
-        fullText: { type: "string", description: "Full page text." },
+        wordCount: { type: "integer", description: "action=save: word count." },
+        fullText: { type: "string", description: "action=save: full page text." },
         internalLinks: {
           type: "array",
           items: { type: "object" },
-          description: "Internal links ({url,text})."
+          description: "action=save: internal links ({url,text})."
         },
         externalLinks: { type: "array", items: { type: "object" } },
-        language: { type: "string", description: "Language code." },
-        ticketNumber: { type: "string", description: "Related ticket number." },
+        language: { type: "string", description: "action=save: language code." },
+        ticketNumber: { type: "string", description: "action=save: related ticket number." },
         metadata: { type: "object" },
         reExtract: {
           type: "boolean",
-          description: "Force a re-fetch even when fields are supplied."
-        }
-      },
-      required: ["projectKey", "url"]
-    }
-  },
-  {
-    name: "list_project_content_corpus",
-    description: "List corpus items for a project (2026-DASMG-041), filter by domain/sourceType/query. Compact, paginated. Use to see content coverage and reuse own pages.",
-    inputSchema: {
-      type: "object",
-      properties: {
-        projectKey: { type: "string", description: "Project identifier (required)." },
-        domain: { type: "string", description: "Domain filter." },
-        sourceType: {
-          type: "string",
-          enum: [
-            "own_site",
-            "client_site",
-            "external_source",
-            "competitor",
-            "news",
-            "government",
-            "supplier",
-            "unknown"
-          ]
+          description: "action=save: force a re-fetch even when fields are supplied."
         },
-        query: { type: "string", description: "Free-text search." },
-        limit: { type: "integer", description: "Max rows (default 20)." },
-        offset: { type: "integer", description: "Pagination offset." },
-        includeFullText: { type: "boolean", description: "Return full_text per row." }
-      },
-      required: ["projectKey"]
-    }
-  },
-  {
-    name: "get_content_context_for_project",
-    description: "Aggregate context for a content agent (2026-DASMG-041): recent corpus items, recent evidence packs and related sources for a project (optionally focused by topic or url), plus totals. One call to brief an agent on what already exists before it writes.",
-    inputSchema: {
-      type: "object",
-      properties: {
-        projectKey: { type: "string", description: "Project identifier (required)." },
-        topic: { type: "string", description: "Optional topic focus." },
-        url: { type: "string", description: "Optional url focus." },
-        limit: { type: "integer", description: "Max items per section (default 10)." }
+        domain: { type: "string", description: "action=list: domain filter." },
+        query: { type: "string", description: "action=list: free-text search." },
+        topic: { type: "string", description: "action=context: optional topic focus." },
+        limit: {
+          type: "integer",
+          description: "action=list: max rows (default 20). action=context: max items per section (default 10)."
+        },
+        offset: { type: "integer", description: "action=list: pagination offset." },
+        includeFullText: { type: "boolean", description: "action=list: return full_text per row." }
       },
-      required: ["projectKey"]
+      required: ["action", "projectKey"]
     }
   },
   {
@@ -11110,19 +11209,31 @@ var TOOLS = [
       required: ["tool"]
     }
   },
+  // ----- Content snapshots / version history (2026-DASMG-041), consolidated -----
   {
-    name: "list_content_snapshots",
-    description: "List historical snapshots for a corpus item or source (2026-DASMG-041) by id, url or canonical url, newest first. Compact; set `includeFullText` for the captured body. Use to see how content changed over time.",
+    name: "content-snapshot",
+    description: 'Historical version snapshots of corpus items / sources (2026-DASMG-041). Pick the operation with `action`:\n- "list": list snapshots for a corpus item or source by id, url or canonical url, newest first. Compact; set `includeFullText` for the captured body. Use to see how content changed over time.\n- "prune": retention cleanup \u2014 keep the newest N snapshots per item and drop the rest older than the retention window (defaults keepPerItem 20, olderThanDays 365). Returns how many were pruned.',
     inputSchema: {
       type: "object",
       properties: {
-        corpusItemId: { type: "string", description: "content_corpus_items.id." },
-        contentSourceId: { type: "string", description: "content_sources.id." },
-        url: { type: "string", description: "URL to match." },
-        canonicalUrl: { type: "string", description: "Canonical URL to match." },
-        limit: { type: "integer", description: "Max rows (default 20)." },
-        includeFullText: { type: "boolean", description: "Return captured full_text." }
-      }
+        action: {
+          type: "string",
+          enum: ["list", "prune"],
+          description: "list = show snapshots; prune = retention cleanup."
+        },
+        corpusItemId: { type: "string", description: "action=list: content_corpus_items.id." },
+        contentSourceId: { type: "string", description: "action=list: content_sources.id." },
+        url: { type: "string", description: "action=list: URL to match." },
+        canonicalUrl: { type: "string", description: "action=list: canonical URL to match." },
+        limit: { type: "integer", description: "action=list: max rows (default 20)." },
+        includeFullText: { type: "boolean", description: "action=list: return captured full_text." },
+        keepPerItem: { type: "integer", description: "action=prune: snapshots to keep per item (default 20)." },
+        olderThanDays: {
+          type: "integer",
+          description: "action=prune: only prune snapshots older than this many days (default 365)."
+        }
+      },
+      required: ["action"]
     }
   },
   {
@@ -11137,31 +11248,41 @@ var TOOLS = [
       required: ["packId", "ticketNumber"]
     }
   },
+  // ----- Content/site candidates (2026-DASMG-041), consolidated -----
   {
-    name: "prune_content_snapshots",
-    description: "Retention cleanup (2026-DASMG-041): keep the newest N snapshots per item and drop the rest older than the retention window. Defaults: keepPerItem 20, olderThanDays 365. Returns how many were pruned.",
-    inputSchema: {
-      type: "object",
-      properties: {
-        keepPerItem: { type: "integer", description: "Snapshots to keep per item (default 20)." },
-        olderThanDays: {
-          type: "integer",
-          description: "Only prune snapshots older than this many days (default 365)."
-        }
-      }
-    }
-  },
-  {
-    name: "add_site_candidates",
-    description: "Record which site(s) a stored source or research pack could be interesting for, for reuse later (2026-DASMG-041). Attach one or more candidates to a contentSourceId and/or packId; each candidate targets a managedSiteId (preferred) or a projectKey/domain. Re-adding the same (subject, target) updates instead of duplicating.",
+    name: "site-candidate",
+    description: 'Which site(s) a stored source/pack could be used on (2026-DASMG-041). Pick the operation with `action`:\n- "add": record candidates \u2014 attach one or more to a contentSourceId and/or packId; each candidate targets a managedSiteId (preferred) or projectKey/domain. Re-adding the same (subject, target) updates instead of duplicating. Required: candidates.\n- "list": list candidates, filter by managedSiteId / projectKey / domain, contentSourceId, packId, status. Use status=candidate to find unused content suggested for a site. Compact, paginated; includes source title / pack topic.\n- "set-status": update a candidate\'s status. status=used marks it published on the site (stamps usedAt + usedCorpusItemId / usedUrl); rejected = not a fit. Required: id, status.',
     inputSchema: {
       type: "object",
       properties: {
-        contentSourceId: { type: "string", description: "content_sources.id (the source to suggest)." },
-        packId: { type: "string", description: "content_evidence_packs.id (the pack to suggest)." },
+        action: {
+          type: "string",
+          enum: ["add", "list", "set-status"],
+          description: "add = record candidates; list = list candidates; set-status = update one candidate."
+        },
+        id: { type: "string", description: "action=set-status: content_site_candidates.id (uuid)." },
+        status: {
+          type: "string",
+          enum: ["candidate", "used", "rejected"],
+          description: "action=set-status: new status (required). action=list: filter \u2014 candidate = suggested, used = published, rejected = not a fit."
+        },
+        usedCorpusItemId: {
+          type: "string",
+          description: "action=set-status: content_corpus_items.id of the page produced (when used)."
+        },
+        usedUrl: { type: "string", description: "action=set-status: URL of the page produced (when used)." },
+        reason: { type: "string", description: "action=set-status: optional note for the status change." },
+        contentSourceId: {
+          type: "string",
+          description: "action=add: the source to suggest. action=list: filter."
+        },
+        packId: {
+          type: "string",
+          description: "action=add: content_evidence_packs.id to suggest. action=list: filter."
+        },
         candidates: {
           type: "array",
-          description: "Target sites. Each needs a managedSiteId, projectKey or domain.",
+          description: "action=add: target sites. Each needs a managedSiteId, projectKey or domain.",
           items: {
             type: "object",
             properties: {
@@ -11174,66 +11295,44 @@ var TOOLS = [
             }
           }
         },
-        ticketNumber: { type: "string", description: "Related ticket number." },
+        managedSiteId: { type: "string", description: "action=list: managed_sites.id filter." },
+        projectKey: { type: "string", description: "action=list: project filter." },
+        domain: { type: "string", description: "action=list: domain filter." },
+        limit: { type: "integer", description: "action=list: max rows (default 20, max 100)." },
+        offset: { type: "integer", description: "action=list: pagination offset." },
+        ticketNumber: { type: "string", description: "action=add: related ticket number." },
         metadata: { type: "object" }
       },
-      required: ["candidates"]
+      required: ["action"]
     }
   },
+  // ----- Managed sites (2026-DASMG-042), consolidated -----
   {
-    name: "list_site_candidates",
-    description: "List content/site candidates (2026-DASMG-041): filter by managedSiteId / projectKey / domain, contentSourceId, packId, status. Use status=candidate to find unused content suggested for a site. Compact; paginated; includes the source title / pack topic for context.",
+    name: "managed-site",
+    description: 'Sites registered for content sync (2026-DASMG-042). Pick the operation with `action`:\n- "register": register (or upsert by projectKey+domain) a site: domain, optional repo/branch + sitemapUrl, syncMode and a git pathUrlMap. Optional + additive \u2014 external/unmanaged sites still work via extract_article without this. Enables git-push/cron/manual ingestion that re-indexes only CHANGED pages. Required: projectKey, domain.\n- "update": update an existing site by id \u2014 only provided fields change (enable/disable, switch syncMode, set sitemapUrl/pathUrlMap, \u2026). Required: id.\n- "list": list managed sites, filter by projectKey/domain/repo/enabledOnly. Compact, paginated.\nTrigger/poll ingestion runs with the `content-sync` tool.',
     inputSchema: {
       type: "object",
       properties: {
-        managedSiteId: { type: "string", description: "managed_sites.id filter." },
-        projectKey: { type: "string", description: "Project filter." },
-        domain: { type: "string", description: "Domain filter." },
-        contentSourceId: { type: "string", description: "content_sources.id filter." },
-        packId: { type: "string", description: "content_evidence_packs.id filter." },
-        status: {
+        action: {
           type: "string",
-          enum: ["candidate", "used", "rejected"],
-          description: "candidate = suggested, used = published there, rejected = not a fit."
+          enum: ["register", "update", "list"],
+          description: "register = upsert a site; update = patch a site by id; list = list sites."
         },
-        limit: { type: "integer", description: "Max rows (default 20, max 100)." },
-        offset: { type: "integer", description: "Pagination offset." }
-      }
-    }
-  },
-  {
-    name: "set_candidate_status",
-    description: "Update a candidate's status (2026-DASMG-041). Set status=used to mark the content as used on the site (stamps usedAt and records usedCorpusItemId / usedUrl), or rejected when it is not a fit.",
-    inputSchema: {
-      type: "object",
-      properties: {
-        id: { type: "string", description: "content_site_candidates.id (uuid)." },
-        status: {
+        id: { type: "string", description: "action=update: managed_sites.id (uuid, required)." },
+        projectKey: {
           type: "string",
-          enum: ["candidate", "used", "rejected"],
-          description: "New status for the candidate."
+          description: "action=register (required): project identifier. action=list: filter."
         },
-        usedCorpusItemId: {
+        domain: {
           type: "string",
-          description: "content_corpus_items.id of the page produced (when used)."
+          description: "action=register (required): site domain, e.g. example.nl. action=list: filter."
         },
-        usedUrl: { type: "string", description: "URL of the page produced (when used)." },
-        reason: { type: "string", description: "Optional note for the status change." }
-      },
-      required: ["id", "status"]
-    }
-  },
-  {
-    name: "register_managed_site",
-    description: "Register (or upsert by projectKey+domain) a site for content sync (2026-DASMG-042): domain, optional repo/branch + sitemapUrl, syncMode and a git pathUrlMap. Optional + additive \u2014 external/unmanaged sites still work via extract_article without this. Enables git-push/cron/manual ingestion that re-indexes only CHANGED pages into the corpus (hash-skips unchanged ones).",
-    inputSchema: {
-      type: "object",
-      properties: {
-        projectKey: { type: "string", description: "Project identifier (required)." },
-        domain: { type: "string", description: "Site domain, e.g. example.nl (required)." },
-        siteKey: { type: "string", description: "Optional site identifier within the project." },
+        siteKey: { type: "string", description: "Site identifier within the project." },
         name: { type: "string", description: "Human-friendly site name." },
-        repo: { type: "string", description: "GitHub repo owner/repo that publishes the site (for git pushes)." },
+        repo: {
+          type: "string",
+          description: "GitHub repo owner/repo that publishes the site (for git pushes). action=list: filter."
+        },
         branch: { type: "string", description: "Branch whose pushes trigger a sync; omit for any branch." },
         sitemapUrl: { type: "string", description: "Sitemap URL for sitemap/hybrid detection." },
         sourceType: {
@@ -11250,11 +11349,12 @@ var TOOLS = [
           ],
           description: "Provenance label for produced corpus items (default own_site)."
         },
-        enabled: { type: "boolean", description: "Whether syncs run (default true)." },
+        enabled: { type: "boolean", description: "register/update: whether syncs run (default true)." },
+        enabledOnly: { type: "boolean", description: "action=list: only enabled sites." },
         syncMode: {
           type: "string",
           enum: ["sitemap", "git", "hybrid", "manual"],
-          description: "Change detection: sitemap (lastmod/hash), git (changed paths via pathUrlMap), hybrid (both), manual (only on trigger_content_sync)."
+          description: "Change detection: sitemap (lastmod/hash), git (changed paths via pathUrlMap), hybrid (both), manual (only via content-sync trigger)."
         },
         pathUrlMap: {
           type: "array",
@@ -11266,106 +11366,49 @@ var TOOLS = [
           type: "boolean",
           description: "Flag changed pages for an MG SEO CLI follow-up (soft handoff)."
         },
+        limit: { type: "integer", description: "action=list: max rows (default 50, max 200)." },
+        offset: { type: "integer", description: "action=list: pagination offset." },
         metadata: { type: "object" }
       },
-      required: ["projectKey", "domain"]
+      required: ["action"]
     }
   },
+  // ----- Content ingestion runs (2026-DASMG-042), consolidated -----
   {
-    name: "update_managed_site",
-    description: "Update an existing managed site by id (2026-DASMG-042). Only the provided fields change \u2014 enable/disable, switch syncMode, set sitemapUrl/pathUrlMap, etc.",
+    name: "content-sync",
+    description: 'Content ingestion runs for a managed site (2026-DASMG-042). Pick the operation with `action`:\n- "trigger": start a run by siteId, or projectKey+domain. Detects changed pages (sitemap/git/hash), re-indexes only changes into the corpus and snapshots the previous version. Returns the runId; poll with action=status.\n- "status": read run status by runId (that run), or by siteId / projectKey+domain (recent runs). Returns changed/skipped/failed counts, the changed URLs, limitations and the site summary.',
     inputSchema: {
       type: "object",
       properties: {
-        id: { type: "string", description: "managed_sites.id (uuid, required)." },
-        name: { type: "string", description: "Human-friendly site name." },
-        domain: { type: "string", description: "Site domain." },
-        siteKey: { type: "string", description: "Site identifier within the project." },
-        repo: { type: "string", description: "GitHub repo owner/repo." },
-        branch: { type: "string", description: "Branch whose pushes trigger a sync." },
-        sitemapUrl: { type: "string", description: "Sitemap URL." },
-        sourceType: {
-          type: "string",
-          enum: [
-            "own_site",
-            "client_site",
-            "external_source",
-            "competitor",
-            "news",
-            "government",
-            "supplier",
-            "unknown"
-          ]
-        },
-        enabled: { type: "boolean", description: "Enable/disable syncs." },
-        syncMode: {
+        action: {
           type: "string",
-          enum: ["sitemap", "git", "hybrid", "manual"]
+          enum: ["trigger", "status"],
+          description: "trigger = start an ingestion run; status = read run status."
         },
-        pathUrlMap: { type: "array", items: { type: "object" } },
-        maxUrlsPerRun: { type: "integer", description: "Per-run URL cap." },
-        exportToSeoCli: { type: "boolean" },
-        metadata: { type: "object" }
-      },
-      required: ["id"]
-    }
-  },
-  {
-    name: "list_managed_sites",
-    description: "List managed sites (2026-DASMG-042), filter by projectKey/domain/repo/enabledOnly. Compact, paginated.",
-    inputSchema: {
-      type: "object",
-      properties: {
-        projectKey: { type: "string", description: "Project filter." },
-        domain: { type: "string", description: "Domain filter." },
-        repo: { type: "string", description: "Repo filter (owner/repo)." },
-        enabledOnly: { type: "boolean", description: "Only enabled sites." },
-        limit: { type: "integer", description: "Max rows (default 50, max 200)." },
-        offset: { type: "integer", description: "Pagination offset." }
-      }
-    }
-  },
-  {
-    name: "trigger_content_sync",
-    description: "Start a content ingestion run for a managed site (2026-DASMG-042) by siteId, or projectKey+domain. Detects changed pages (sitemap/git/hash), re-indexes only changes into the corpus and snapshots the previous version. Returns the runId; poll get_content_sync_status for results.",
-    inputSchema: {
-      type: "object",
-      properties: {
         siteId: { type: "string", description: "managed_sites.id (uuid)." },
         projectKey: { type: "string", description: "Project identifier (with domain)." },
         domain: { type: "string", description: "Site domain (with projectKey)." },
+        runId: { type: "string", description: "action=status: content_ingestion_runs.id (uuid)." },
         triggerType: {
           type: "string",
           enum: ["manual", "git_push", "deploy", "cron", "sitemap"],
-          description: "Trigger label recorded on the run (default manual)."
+          description: "action=trigger: label recorded on the run (default manual)."
         },
-        sourceCommit: { type: "string", description: "Source git commit/deploy id, when known." },
-        sourceRef: { type: "string", description: "Source git ref, when known." },
+        sourceCommit: { type: "string", description: "action=trigger: source git commit/deploy id, when known." },
+        sourceRef: { type: "string", description: "action=trigger: source git ref, when known." },
         urls: {
           type: "array",
           items: { type: "string" },
-          description: "Restrict the run to these URLs (skips detection)."
+          description: "action=trigger: restrict the run to these URLs (skips detection)."
         },
         changedPaths: {
           type: "array",
           items: { type: "string" },
-          description: "Changed repo paths to map to URLs via pathUrlMap."
-        }
-      }
-    }
-  },
-  {
-    name: "get_content_sync_status",
-    description: "Read ingestion run status (2026-DASMG-042): by runId (that run), or by siteId / projectKey+domain (recent runs). Returns changed/skipped/failed counts, the changed URLs, limitations and the site summary.",
-    inputSchema: {
-      type: "object",
-      properties: {
-        runId: { type: "string", description: "content_ingestion_runs.id (uuid)." },
-        siteId: { type: "string", description: "managed_sites.id (uuid)." },
-        projectKey: { type: "string", description: "Project identifier (with domain)." },
-        domain: { type: "string", description: "Site domain (with projectKey)." },
-        limit: { type: "integer", description: "Max recent runs to return (default 10)." }
-      }
+          description: "action=trigger: changed repo paths to map to URLs via pathUrlMap."
+        },
+        limit: { type: "integer", description: "action=status: max recent runs to return (default 10)." }
+      },
+      required: ["action"]
     }
   },
   {
@@ -11472,8 +11515,10 @@ var MCP_VERSION = "7.3.0";
 async function handleListTools() {
   if (!authContext) return { tools: TOOLS };
   const allowedTools = authContext.allowedTools;
+  const isSuperadmin = authContext.roleName === "superadmin";
   const accessible = TOOLS.filter((tool) => {
     if (allowedTools && !allowedTools.includes(tool.name)) return false;
+    if (SUPERADMIN_ONLY_TOOLS.has(tool.name) && !isSuperadmin) return false;
     const requiredModule = TOOL_MODULE_MAP[tool.name];
     if (!requiredModule) return true;
     return authContext.permissions.modules[requiredModule] === true;
@@ -11496,6 +11541,16 @@ async function handleCallTool(request) {
       ]
     };
   }
+  if (SUPERADMIN_ONLY_TOOLS.has(name) && authContext.roleName !== "superadmin") {
+    return {
+      content: [
+        {
+          type: "text",
+          text: `Access denied: "${name}" is restricted to superadmins (it manages production secrets).`
+        }
+      ]
+    };
+  }
   const requiredModule = TOOL_MODULE_MAP[name];
   if (requiredModule && authContext.permissions.modules[requiredModule] !== true) {
     return {
@@ -11631,106 +11686,31 @@ async function executeToolCall(name, a, _serverId) {
           content: [{ type: "text", text: JSON.stringify(data, null, 2) }]
         };
       }
-      case "research_topic": {
-        const urls = Array.isArray(a.urls) ? a.urls.filter((u) => typeof u === "string") : void 0;
-        const topic = typeof a.topic === "string" ? a.topic.trim() : void 0;
-        if ((!urls || urls.length === 0) && !topic) {
-          return {
-            content: [
-              { type: "text", text: "Error: provide `urls` (curated) and/or a `topic`" }
-            ]
-          };
-        }
-        const res = await fetch(`${dashboardBaseUrl}/api/tools/research-topic`, {
-          method: "POST",
-          headers: {
-            "content-type": "application/json",
-            authorization: `Bearer ${apiKey}`
-          },
-          body: JSON.stringify({
-            topic,
-            urls,
-            discover: a.discover && typeof a.discover === "object" ? a.discover : void 0,
-            includeRawText: typeof a.includeRawText === "boolean" ? a.includeRawText : void 0,
-            maxRawTextChars: typeof a.maxRawTextChars === "number" ? a.maxRawTextChars : void 0
-          })
-        });
-        if (!res.ok) {
-          const detail = await res.text().catch(() => "");
-          return {
-            content: [
-              {
-                type: "text",
-                text: `Error: research_topic failed (${res.status}). ${detail.slice(0, 300)}`
-              }
-            ]
-          };
-        }
-        const data = await res.json();
-        return {
-          content: [{ type: "text", text: JSON.stringify(data, null, 2) }]
-        };
-      }
-      // ----- Content registry / corpus persistence (2026-DASMG-041) -----
-      // All content-registry tools proxy to one dispatcher route; the tool name
-      // is the dispatcher `action` and the args are forwarded verbatim as
-      // `params` (the route validates them with the matching Zod schema).
-      case "save_content_source":
-      case "get_content_source_by_url":
-      case "get_content_source_by_id":
-      case "search_content_sources":
-      case "save_research_pack":
-      case "get_research_pack":
-      case "save_content_corpus_item":
-      case "list_project_content_corpus":
-      case "get_content_context_for_project":
+      // ----- Content family (2026-DASMG-040/041/042), consolidated -----
+      // Action-based tools + the two singletons, mapped to the backend
+      // content-registry / managed-site / research-topic dispatchers by
+      // resolveContentDispatch (the backend still speaks the granular action
+      // names, so no server change is needed).
+      case "research":
+      case "content-source":
+      case "content-corpus":
+      case "content-snapshot":
+      case "site-candidate":
+      case "managed-site":
+      case "content-sync":
       case "save_content_quality_run":
-      case "list_content_snapshots":
-      case "link_content_pack_to_ticket":
-      case "prune_content_snapshots":
-      case "add_site_candidates":
-      case "list_site_candidates":
-      case "set_candidate_status": {
-        const res = await fetch(`${dashboardBaseUrl}/api/tools/content-registry`, {
-          method: "POST",
-          headers: {
-            "content-type": "application/json",
-            authorization: `Bearer ${apiKey}`
-          },
-          body: JSON.stringify({ action: name, params: a })
-        });
-        if (!res.ok) {
-          const detail = await res.text().catch(() => "");
-          return {
-            content: [
-              {
-                type: "text",
-                text: `Error: ${name} failed (${res.status}). ${detail.slice(0, 300)}`
-              }
-            ]
-          };
+      case "link_content_pack_to_ticket": {
+        const dispatch = resolveContentDispatch(name, a);
+        if ("error" in dispatch) {
+          return { content: [{ type: "text", text: `Error: ${dispatch.error}` }] };
         }
-        const data = await res.json();
-        return {
-          content: [{ type: "text", text: JSON.stringify(data, null, 2) }]
-        };
-      }
-      // ----- Managed site content sync (2026-DASMG-042) -----
-      // The 5 PUBLIC managed-site tools proxy to one dispatcher route; the tool
-      // name is the dispatcher `action`, args forwarded verbatim as `params`
-      // (the route validates them and only allows the public actions).
-      case "register_managed_site":
-      case "update_managed_site":
-      case "list_managed_sites":
-      case "trigger_content_sync":
-      case "get_content_sync_status": {
-        const res = await fetch(`${dashboardBaseUrl}/api/tools/managed-site`, {
+        const res = await fetch(`${dashboardBaseUrl}/api/tools/${dispatch.route}`, {
           method: "POST",
           headers: {
             "content-type": "application/json",
             authorization: `Bearer ${apiKey}`
           },
-          body: JSON.stringify({ action: name, params: a })
+          body: JSON.stringify(dispatch.body)
         });
         if (!res.ok) {
           const detail = await res.text().catch(() => "");